feat(P4): transparent terraform + feature flags + run_platform.sh split (REQ-233..238)

Create run_codegen.sh (pre-TF: env check, validate, resolve, adapt).
Create run_postapply.sh (post-TF: Checkov, confidence, HITL, outbox, SSM, uptime).
Add variable 'enabled' (bool, default true) + count=var.enabled?1:0 to all 12
L1 modules (alb, cloudfront, ecr, ecs-cluster, ecs-service, iam-role, kms-key,
rds, s3, uptime, vpc, waf). Fix all cross-resource references with [0] indexing.
Update interface.json for all modules to declare 'enabled' input.
Fix stale artifact path /tmp/acdl_platform_run_v18 → /tmp/nova_platform_run (REQ-238).
run_platform.sh remains as backward-compat shim for local-dev usage.

---ci---
project: acdl
phase: 4
milestone: v1.20
status: execute
requirements: [REQ-233, REQ-234, REQ-235, REQ-236, REQ-237, REQ-238]
---/ci---

modules/l1/alb/interface.json

@@ -48,6 +48,11 @@
       "description": "Target group target type (ip or instance).",
       "required": false,
       "default": "ip"
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {
@@ -85,20 +90,42 @@
     {
       "type": "aws:elbv2:loadbalancer",
       "description": "Application load balancer in the VPC subnets.",
-      "inputs": ["name", "subnets", "security_group", "load_balancer_type"],
-      "outputs": ["lb_arn"]
+      "inputs": [
+        "name",
+        "subnets",
+        "security_group",
+        "load_balancer_type"
+      ],
+      "outputs": [
+        "lb_arn"
+      ]
     },
     {
       "type": "aws:elbv2:targetgroup",
       "description": "Target group for the ECS service tasks.",
-      "inputs": ["name", "port", "protocol", "vpc_id", "target_type"],
-      "outputs": ["target_group_arn"]
+      "inputs": [
+        "name",
+        "port",
+        "protocol",
+        "vpc_id",
+        "target_type"
+      ],
+      "outputs": [
+        "target_group_arn"
+      ]
     },
     {
       "type": "aws:elbv2:listener",
       "description": "Listener forwarding the LB port to the target group.",
-      "inputs": ["lb_arn", "port", "protocol", "target_group_arn"],
-      "outputs": ["listener_arn"]
+      "inputs": [
+        "lb_arn",
+        "port",
+        "protocol",
+        "target_group_arn"
+      ],
+      "outputs": [
+        "listener_arn"
+      ]
     }
   ]
-}
+}

modules/l1/alb/terraform/main.tf

@@ -1,4 +1,5 @@
 resource "aws_lb" "this" {
+  count = var.enabled ? 1 : 0
   name               = var.name
   load_balancer_type = var.load_balancer_type
   subnets            = local.subnet_list
@@ -6,6 +7,7 @@ resource "aws_lb" "this" {
 }
 
 resource "aws_lb_target_group" "this" {
+  count = var.enabled ? 1 : 0
   name_prefix = "${var.name}-"
   port        = var.port
   protocol    = var.protocol
@@ -18,13 +20,14 @@ resource "aws_lb_target_group" "this" {
 }
 
 resource "aws_lb_listener" "this" {
-  load_balancer_arn = aws_lb.this.id
+  count = var.enabled ? 1 : 0
+  load_balancer_arn = aws_lb.this[0].id
   port              = var.port
   protocol          = var.protocol
 
   default_action {
     type             = "forward"
-    target_group_arn = aws_lb_target_group.this.arn
+    target_group_arn = aws_lb_target_group.this[0].arn
   }
 
   depends_on = [aws_lb_target_group.this]

modules/l1/alb/terraform/outputs.tf

@@ -1,14 +1,14 @@
 output "lb_arn" {
-  value       = aws_lb.this.id
+  value       = aws_lb.this[0].id
   description = "The load balancer ARN."
 }
 
 output "listener_arn" {
-  value       = aws_lb_listener.this.arn
+  value       = aws_lb_listener.this[0].arn
   description = "The listener ARN."
 }
 
 output "target_group_arn" {
-  value       = aws_lb_target_group.this.arn
+  value       = aws_lb_target_group.this[0].arn
   description = "The target group ARN."
 }

modules/l1/alb/terraform/variables.tf

@@ -50,3 +50,9 @@ variable "vpc_id" {
   description = "VPC ID for the target group (ref to vpc or platform VPC)."
   default     = null
 }
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}

modules/l1/cloudfront/interface.json

@@ -43,6 +43,11 @@
       "type": "string",
       "description": "AWS region (CloudFront is global but the provider region is used for the OAC).",
       "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {
@@ -75,17 +80,37 @@
     {
       "type": "aws:cloudfront:distribution",
       "description": "CloudFront distribution with S3 origin via OAC.",
-      "inputs": ["bucket_regional_domain_name", "price_class", "viewer_protocol_policy", "default_ttl", "max_ttl", "waf_web_acl_arn", "oac_id"],
-      "outputs": ["distribution_arn", "distribution_domain_name"]
+      "inputs": [
+        "bucket_regional_domain_name",
+        "price_class",
+        "viewer_protocol_policy",
+        "default_ttl",
+        "max_ttl",
+        "waf_web_acl_arn",
+        "oac_id"
+      ],
+      "outputs": [
+        "distribution_arn",
+        "distribution_domain_name"
+      ]
     },
     {
       "type": "aws:cloudfront:originaccesscontrol",
       "description": "Origin Access Control for the S3 origin.",
-      "inputs": ["name", "origin_type", "signing_behavior"],
-      "outputs": ["oac_id"]
+      "inputs": [
+        "name",
+        "origin_type",
+        "signing_behavior"
+      ],
+      "outputs": [
+        "oac_id"
+      ]
     }
   ],
   "intra_refs": [
-    {"from": "aws:cloudfront:distribution.oac_id", "to": "aws:cloudfront:originaccesscontrol.oac_id"}
+    {
+      "from": "aws:cloudfront:distribution.oac_id",
+      "to": "aws:cloudfront:originaccesscontrol.oac_id"
+    }
   ]
-}
+}

modules/l1/cloudfront/terraform/main.tf

@@ -1,4 +1,5 @@
 resource "aws_cloudfront_origin_access_control" "this" {
+  count = var.enabled ? 1 : 0
   name                              = local.oac_name
   origin_access_control_origin_type = local.oac_origin_type
   signing_behavior                  = local.oac_signing_behavior
@@ -6,10 +7,11 @@ resource "aws_cloudfront_origin_access_control" "this" {
 }
 
 resource "aws_cloudfront_distribution" "this" {
+  count = var.enabled ? 1 : 0
   origin {
     origin_id                = "s3-origin"
     domain_name              = var.bucket_regional_domain_name
-    origin_access_control_id = aws_cloudfront_origin_access_control.this.id
+    origin_access_control_id = aws_cloudfront_origin_access_control.this[0].id
     s3_origin_config {
       origin_access_identity = ""
     }

modules/l1/cloudfront/terraform/outputs.tf

@@ -1,14 +1,14 @@
 output "distribution_arn" {
-  value       = aws_cloudfront_distribution.this.arn
+  value       = aws_cloudfront_distribution.this[0].arn
   description = "The CloudFront distribution ARN."
 }
 
 output "distribution_domain_name" {
-  value       = aws_cloudfront_distribution.this.domain_name
+  value       = aws_cloudfront_distribution.this[0].domain_name
   description = "The CloudFront distribution domain name."
 }
 
 output "oac_id" {
-  value       = aws_cloudfront_origin_access_control.this.id
+  value       = aws_cloudfront_origin_access_control.this[0].id
   description = "The Origin Access Control ID."
 }

modules/l1/cloudfront/terraform/variables.tf

@@ -38,3 +38,9 @@ variable "region" {
   description = "AWS region (CloudFront is global but the provider region is used for the OAC)."
   default     = null
 }
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}

modules/l1/ecr/interface.json

@@ -19,6 +19,11 @@
       "type": "string",
       "description": "ARN of the CMK for repository encryption; if absent, uses AWS-managed key.",
       "required": false
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {
@@ -48,4 +53,4 @@
       "default": true
     }
   }
-}
+}

modules/l1/ecr/terraform/main.tf

@@ -6,6 +6,7 @@ locals {
 }
 
 resource "aws_ecr_repository" "this" {
+  count = var.enabled ? 1 : 0
   name                 = var.name
   image_tag_mutability = "MUTABLE"
   image_scanning_configuration {

modules/l1/ecr/terraform/outputs.tf

@@ -1,9 +1,9 @@
 output "repository_url" {
-  value       = aws_ecr_repository.this.repository_url
+  value       = aws_ecr_repository.this[0].repository_url
   description = "The ECR repository URL."
 }
 
 output "repository_arn" {
-  value       = aws_ecr_repository.this.arn
+  value       = aws_ecr_repository.this[0].arn
   description = "The ECR repository ARN."
 }

modules/l1/ecr/terraform/variables.tf

@@ -13,4 +13,10 @@ variable "kms_key_arn" {
   type        = string
   description = "ARN of the CMK for ECR encryption; if absent, uses managed key."
   default     = null
-}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}

modules/l1/ecs-cluster/interface.json

@@ -19,6 +19,11 @@
       "type": "string",
       "description": "ARN of the CMK for CloudWatch log group encryption; if absent, uses managed key.",
       "required": false
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {
@@ -43,4 +48,4 @@
       "default": true
     }
   }
-}
+}

modules/l1/ecs-cluster/terraform/main.tf

@@ -1,3 +1,4 @@
 resource "aws_ecs_cluster" "this" {
+  count = var.enabled ? 1 : 0
   name = var.name
 }

modules/l1/ecs-cluster/terraform/outputs.tf

@@ -1,9 +1,9 @@
 output "cluster_arn" {
-  value       = aws_ecs_cluster.this.arn
+  value       = aws_ecs_cluster.this[0].arn
   description = "The ECS cluster ARN."
 }
 
 output "cluster_id" {
-  value       = aws_ecs_cluster.this.id
+  value       = aws_ecs_cluster.this[0].id
   description = "The ECS cluster ID."
 }

modules/l1/ecs-cluster/terraform/variables.tf

@@ -15,3 +15,9 @@ variable "kms_key_arn" {
   description = "ARN of the CMK for CloudWatch log group encryption; if absent, uses managed key."
   default     = null
 }
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}

modules/l1/ecs-service/interface.json

@@ -79,6 +79,11 @@
       "description": "ECS task definition family name.",
       "required": false,
       "default": "app"
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {
@@ -107,14 +112,32 @@
     {
       "type": "aws:ecs:task_definition",
       "description": "Fargate task definition; the adapter jsonencodes image/port/env into container_definitions.",
-      "inputs": ["image", "port", "cpu", "memory", "env", "family"],
-      "outputs": ["task_def_arn"]
+      "inputs": [
+        "image",
+        "port",
+        "cpu",
+        "memory",
+        "env",
+        "family"
+      ],
+      "outputs": [
+        "task_def_arn"
+      ]
     },
     {
       "type": "aws:ecs:service",
       "description": "Fargate service running the task definition in the cluster + subnets.",
-      "inputs": ["cluster_arn", "subnets", "security_group", "lb_target_group_arn", "desired_count", "launch_type"],
-      "outputs": ["service_arn"]
+      "inputs": [
+        "cluster_arn",
+        "subnets",
+        "security_group",
+        "lb_target_group_arn",
+        "desired_count",
+        "launch_type"
+      ],
+      "outputs": [
+        "service_arn"
+      ]
     }
   ]
-}
+}

modules/l1/ecs-service/terraform/main.tf

@@ -1,4 +1,5 @@
 resource "aws_ecs_task_definition" "this" {
+  count = var.enabled ? 1 : 0
   family                   = var.family
   cpu                      = tostring(var.cpu)
   memory                   = tostring(var.memory)
@@ -8,9 +9,10 @@ resource "aws_ecs_task_definition" "this" {
 }
 
 resource "aws_ecs_service" "this" {
+  count = var.enabled ? 1 : 0
   name            = "nova-microservice"
   cluster         = var.cluster_arn
-  task_definition = aws_ecs_task_definition.this.arn
+  task_definition = aws_ecs_task_definition.this[0].arn
   desired_count   = var.desired_count
   launch_type     = var.launch_type
 

modules/l1/ecs-service/terraform/outputs.tf

@@ -1,9 +1,9 @@
 output "service_arn" {
-  value       = aws_ecs_service.this.id
+  value       = aws_ecs_service.this[0].id
   description = "The ECS service ARN."
 }
 
 output "task_def_arn" {
-  value       = aws_ecs_task_definition.this.arn
+  value       = aws_ecs_task_definition.this[0].arn
   description = "The ECS task definition ARN."
 }

modules/l1/ecs-service/terraform/variables.tf

@@ -78,3 +78,9 @@ variable "family" {
   description = "ECS task definition family name."
   default     = "app"
 }
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}

modules/l1/iam-role/interface.json

@@ -24,6 +24,11 @@
       "type": "string",
       "description": "AWS region the role is created in.",
       "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {
@@ -48,4 +53,4 @@
       "default": true
     }
   }
-}
+}

modules/l1/iam-role/terraform/main.tf

@@ -1,11 +1,12 @@
 resource "aws_iam_role" "this" {
+  count = var.enabled ? 1 : 0
   name               = var.role_name
   assume_role_policy = local.assume_role_policy
 }
 
 resource "aws_iam_role_policy" "ecr_logs" {
-  count  = local.inline_policy != null ? 1 : 0
+  count  = (local.inline_policy != null && var.enabled) ? 1 : 0
   name   = local.inline_policy.name
-  role   = aws_iam_role.this.id
+  role   = aws_iam_role.this[0].id
   policy = local.inline_policy.policy
 }

modules/l1/iam-role/terraform/outputs.tf

@@ -1,9 +1,9 @@
 output "role_arn" {
-  value       = aws_iam_role.this.arn
+  value       = aws_iam_role.this[0].arn
   description = "The IAM role ARN."
 }
 
 output "role_id" {
-  value       = aws_iam_role.this.id
+  value       = aws_iam_role.this[0].id
   description = "The IAM role ID."
 }

modules/l1/iam-role/terraform/variables.tf

@@ -21,3 +21,9 @@ variable "region" {
   description = "AWS region (provider-level; not a resource arg)."
   default     = null
 }
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}

modules/l1/kms-key/interface.json

@@ -20,6 +20,11 @@
       "description": "Number of days before the key is deleted after deletion is requested (default 30).",
       "required": false,
       "default": 30
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {
@@ -49,4 +54,4 @@
       "default": true
     }
   }
-}
+}

modules/l1/kms-key/terraform/main.tf

@@ -1,10 +1,12 @@
 resource "aws_kms_key" "this" {
+  count = var.enabled ? 1 : 0
   description             = var.description
   enable_key_rotation     = true
   deletion_window_in_days = var.deletion_window_days
 }
 
 resource "aws_kms_alias" "this" {
+  count = var.enabled ? 1 : 0
   name          = local.alias_name
-  target_key_id = aws_kms_key.this.key_id
+  target_key_id = aws_kms_key.this[0].key_id
 }

modules/l1/kms-key/terraform/outputs.tf

@@ -1,9 +1,9 @@
 output "kms_key_arn" {
-  value       = aws_kms_key.this.arn
+  value       = aws_kms_key.this[0].arn
   description = "The KMS key ARN."
 }
 
 output "kms_key_id" {
-  value       = aws_kms_key.this.key_id
+  value       = aws_kms_key.this[0].key_id
   description = "The KMS key ID."
 }

modules/l1/kms-key/terraform/variables.tf

@@ -14,4 +14,10 @@ variable "deletion_window_days" {
   type        = number
   description = "Deletion window in days (7-30)."
   default     = 30
-}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}

modules/l1/rds/interface.json

@@ -79,6 +79,11 @@
       "description": "Database admin password",
       "required": false,
       "default": "ACdlcI2026!"
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {

modules/l1/rds/terraform/main.tf

@@ -5,6 +5,7 @@ resource "aws_db_subnet_group" "this" {
 }
 
 resource "aws_db_instance" "this" {
+  count = var.enabled ? 1 : 0
   engine               = var.engine
   engine_version       = var.engine_version
   instance_class       = var.instance_class

modules/l1/rds/terraform/outputs.tf

@@ -1,9 +1,9 @@
 output "db_endpoint" {
-  value       = aws_db_instance.this.endpoint
+  value       = aws_db_instance.this[0].endpoint
   description = "The RDS instance endpoint."
 }
 
 output "db_arn" {
-  value       = aws_db_instance.this.arn
+  value       = aws_db_instance.this[0].arn
   description = "The RDS instance ARN."
 }

modules/l1/rds/terraform/variables.tf

@@ -64,3 +64,9 @@ variable "subnet_ids" {
   description = "Comma-separated subnet IDs for the DB subnet group (VPC-dependent)."
   default     = ""
 }
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}

modules/l1/s3/interface.json

@@ -19,6 +19,11 @@
       "type": "string",
       "description": "ARN of the CMK for SSE-KMS; if absent, uses managed key.",
       "required": false
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {
@@ -57,4 +62,4 @@
       "default": true
     }
   }
-}
+}

modules/l1/s3/terraform/main.tf

@@ -1,10 +1,12 @@
 resource "aws_s3_bucket" "this" {
+  count = var.enabled ? 1 : 0
   bucket = var.bucket_name
   tags   = local.tags
 }
 
 resource "aws_s3_bucket_versioning" "this" {
-  bucket = aws_s3_bucket.this.id
+  count = var.enabled ? 1 : 0
+  bucket = aws_s3_bucket.this[0].id
 
   versioning_configuration {
     status = "Enabled"
@@ -12,7 +14,8 @@ resource "aws_s3_bucket_versioning" "this" {
 }
 
 resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
-  bucket = aws_s3_bucket.this.id
+  count = var.enabled ? 1 : 0
+  bucket = aws_s3_bucket.this[0].id
 
   rule {
     apply_server_side_encryption_by_default {

modules/l1/s3/terraform/outputs.tf

@@ -1,14 +1,14 @@
 output "bucket_arn" {
-  value       = aws_s3_bucket.this.arn
+  value       = aws_s3_bucket.this[0].arn
   description = "The S3 bucket ARN."
 }
 
 output "bucket_name" {
-  value       = aws_s3_bucket.this.id
+  value       = aws_s3_bucket.this[0].id
   description = "The bucket name (echoes the input)."
 }
 
 output "bucket_regional_domain_name" {
-  value       = aws_s3_bucket.this.bucket_regional_domain_name
+  value       = aws_s3_bucket.this[0].bucket_regional_domain_name
   description = "The bucket regional domain name (e.g. nova-spike-bucket.s3.us-east-1.amazonaws.com)."
 }

modules/l1/s3/terraform/variables.tf

@@ -19,4 +19,10 @@ variable "tags" {
   type        = map(string)
   description = "Additional tags to merge with the module defaults."
   default     = {}
-}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}

modules/l1/uptime/interface.json

@@ -71,6 +71,11 @@
       "type": "string",
       "description": "ECS cluster ARN to deploy the service into",
       "required": false
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {
@@ -99,4 +104,4 @@
       "default": true
     }
   }
-}
+}

modules/l1/uptime/terraform/main.tf

@@ -11,7 +11,7 @@ resource "aws_ecs_service" "uptime" {
   name            = "nova-uptime"
   cluster         = local.cluster_ref
   task_definition = aws_ecs_task_definition.uptime.arn
-  desired_count   = var.feature_flag_enabled ? 1 : 0
+  desired_count   = var.enabled ? (var.feature_flag_enabled ? 1 : 0) : 0
   launch_type     = "FARGATE"
 
   dynamic "network_configuration" {

modules/l1/uptime/terraform/variables.tf

@@ -69,3 +69,9 @@ variable "cluster_arn" {
   description = "ECS cluster ARN to deploy the service into."
   default     = ""
 }
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}

modules/l1/vpc/interface.json

@@ -24,6 +24,11 @@
       "type": "string",
       "description": "AWS region the VPC is created in.",
       "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {
@@ -57,24 +62,44 @@
     {
       "type": "aws:ec2:vpc",
       "description": "The VPC itself.",
-      "inputs": ["cidr", "name"],
-      "outputs": ["vpc_id"]
+      "inputs": [
+        "cidr",
+        "name"
+      ],
+      "outputs": [
+        "vpc_id"
+      ]
     },
     {
       "type": "aws:ec2:subnet",
       "description": "One subnet per availability zone (azs split on comma).",
-      "inputs": ["cidr", "az", "vpc_id", "name"],
-      "outputs": ["subnet_ids"]
+      "inputs": [
+        "cidr",
+        "az",
+        "vpc_id",
+        "name"
+      ],
+      "outputs": [
+        "subnet_ids"
+      ]
     },
     {
       "type": "aws:ec2:routetable",
       "description": "Route table bound to the VPC with an internet gateway + default route.",
-      "inputs": ["vpc_id"],
+      "inputs": [
+        "vpc_id"
+      ],
       "outputs": []
     }
   ],
   "intra_refs": [
-    {"from": "aws:ec2:subnet.vpc_id", "to": "aws:ec2:vpc.vpc_id"},
-    {"from": "aws:ec2:routetable.vpc_id", "to": "aws:ec2:vpc.vpc_id"}
+    {
+      "from": "aws:ec2:subnet.vpc_id",
+      "to": "aws:ec2:vpc.vpc_id"
+    },
+    {
+      "from": "aws:ec2:routetable.vpc_id",
+      "to": "aws:ec2:vpc.vpc_id"
+    }
   ]
-}
+}

modules/l1/vpc/terraform/main.tf

@@ -1,4 +1,5 @@
 resource "aws_vpc" "this" {
+  count = var.enabled ? 1 : 0
   cidr_block = local.cidr_block
   tags = {
     Name = local.name_tag
@@ -11,7 +12,7 @@ resource "aws_vpc" "this" {
 
 resource "aws_subnet" "this" {
   count             = length(local.az_list)
-  vpc_id            = aws_vpc.this.id
+  vpc_id            = aws_vpc.this[0].id
   cidr_block        = local.subnet_cidrs[count.index]
   availability_zone = local.az_list[count.index]
   tags = {
@@ -20,17 +21,19 @@ resource "aws_subnet" "this" {
 }
 
 resource "aws_internet_gateway" "this" {
-  vpc_id = aws_vpc.this.id
+  count = var.enabled ? 1 : 0
+  vpc_id = aws_vpc.this[0].id
   tags = {
     Name = "${local.name_tag}-igw"
   }
 }
 
 resource "aws_route_table" "this" {
-  vpc_id = aws_vpc.this.id
+  count = var.enabled ? 1 : 0
+  vpc_id = aws_vpc.this[0].id
   route {
     cidr_block = "0.0.0.0/0"
-    gateway_id = aws_internet_gateway.this.id
+    gateway_id = aws_internet_gateway.this[0].id
   }
   tags = {
     Name = "${local.name_tag}-rt"
@@ -40,5 +43,5 @@ resource "aws_route_table" "this" {
 resource "aws_route_table_association" "this" {
   count          = length(local.az_list)
   subnet_id      = aws_subnet.this[count.index].id
-  route_table_id = aws_route_table.this.id
+  route_table_id = aws_route_table.this[0].id
 }

modules/l1/vpc/terraform/outputs.tf

@@ -1,5 +1,5 @@
 output "vpc_id" {
-  value       = aws_vpc.this.id
+  value       = aws_vpc.this[0].id
   description = "The VPC id."
 }
 

modules/l1/vpc/terraform/variables.tf

@@ -21,3 +21,9 @@ variable "region" {
   description = "AWS region (provider-level; not a resource arg)."
   default     = null
 }
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}

modules/l1/waf/interface.json

@@ -31,6 +31,11 @@
       "type": "string",
       "description": "AWS region (CloudFront-scoped WAF is always us-east-1; the adapter ignores this for cloudfront scope).",
       "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
     }
   },
   "outputs": {
@@ -60,8 +65,15 @@
     {
       "type": "aws:wafv2:webacl",
       "description": "WAFv2 Web ACL with managed rules.",
-      "inputs": ["name", "scope", "default_action", "rules"],
-      "outputs": ["web_acl_arn"]
+      "inputs": [
+        "name",
+        "scope",
+        "default_action",
+        "rules"
+      ],
+      "outputs": [
+        "web_acl_arn"
+      ]
     }
   ]
-}
+}

modules/l1/waf/terraform/main.tf

@@ -1,4 +1,5 @@
 resource "aws_wafv2_web_acl" "this" {
+  count = var.enabled ? 1 : 0
   name  = var.name
   scope = local.scope
 

modules/l1/waf/terraform/outputs.tf

@@ -1,4 +1,4 @@
 output "web_acl_arn" {
-  value       = aws_wafv2_web_acl.this.arn
+  value       = aws_wafv2_web_acl.this[0].arn
   description = "The WAF Web ACL ARN."
 }

modules/l1/waf/terraform/variables.tf

@@ -27,3 +27,9 @@ variable "region" {
   description = "AWS region (provider-level; not a resource arg)."
   default     = null
 }
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}